From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:355 mes_v12_1_remove_hw_queue() error: buffer overflow 'mes->master_xcc_ids' 16 <= s32max
Date: Fri, 07 Aug 2026 17:19:23 +0800 [thread overview]
Message-ID: <202608071720.ea61NlTG-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Jack Xiao <Jack.Xiao@amd.com>
CC: Alex Deucher <alexander.deucher@amd.com>
CC: Hawking Zhang <Hawking.Zhang@amd.com>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 6c68fa601b49683ecb04eded993a71dfa8b2ba0b
commit: 75053887d6d8f527578ffcb1113bc336fae49b42 drm/amdgpu/mes12_1: add cooperative dispatch support
date: 8 months ago
:::::: branch date: 13 hours ago
:::::: commit date: 8 months ago
config: i386-randconfig-141-20260806 (https://download.01.org/0day-ci/archive/20260807/202608071720.ea61NlTG-lkp@intel.com/config)
compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 75053887d6d8 ("drm/amdgpu/mes12_1: add cooperative dispatch support")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202608071720.ea61NlTG-lkp@intel.com/
New smatch warnings:
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:355 mes_v12_1_remove_hw_queue() error: buffer overflow 'mes->master_xcc_ids' 16 <= s32max
Old smatch warnings:
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:296 mes_v12_1_add_hw_queue() error: buffer overflow 'mes->master_xcc_ids' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1313 mes_v12_1_kiq_enable_queue() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1614 mes_v12_1_kiq_dequeue_sched() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1702 mes_v12_1_kiq_hw_fini() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1705 mes_v12_1_kiq_hw_fini() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1710 mes_v12_1_kiq_hw_fini() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1723 mes_v12_1_xcc_hw_init() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1778 mes_v12_1_xcc_hw_init() error: buffer overflow 'adev->mes.ring' 16 <= s32max
vim +355 drivers/gpu/drm/amd/amdgpu/mes_v12_1.c
e220edf2d6fd6d Jack Xiao 2025-05-14 346
e220edf2d6fd6d Jack Xiao 2025-05-14 347 static int mes_v12_1_remove_hw_queue(struct amdgpu_mes *mes,
e220edf2d6fd6d Jack Xiao 2025-05-14 348 struct mes_remove_queue_input *input)
e220edf2d6fd6d Jack Xiao 2025-05-14 349 {
e220edf2d6fd6d Jack Xiao 2025-05-14 350 union MESAPI__REMOVE_QUEUE mes_remove_queue_pkt;
75053887d6d8f5 Jack Xiao 2025-03-10 351 int xcc_id = input->xcc_id;
75053887d6d8f5 Jack Xiao 2025-03-10 352 int inst = MES_PIPE_INST(xcc_id, AMDGPU_MES_SCHED_PIPE);
75053887d6d8f5 Jack Xiao 2025-03-10 353
75053887d6d8f5 Jack Xiao 2025-03-10 354 if (mes->enable_coop_mode)
75053887d6d8f5 Jack Xiao 2025-03-10 @355 xcc_id = mes->master_xcc_ids[inst];
e220edf2d6fd6d Jack Xiao 2025-05-14 356
e220edf2d6fd6d Jack Xiao 2025-05-14 357 memset(&mes_remove_queue_pkt, 0, sizeof(mes_remove_queue_pkt));
e220edf2d6fd6d Jack Xiao 2025-05-14 358
e220edf2d6fd6d Jack Xiao 2025-05-14 359 mes_remove_queue_pkt.header.type = MES_API_TYPE_SCHEDULER;
e220edf2d6fd6d Jack Xiao 2025-05-14 360 mes_remove_queue_pkt.header.opcode = MES_SCH_API_REMOVE_QUEUE;
e220edf2d6fd6d Jack Xiao 2025-05-14 361 mes_remove_queue_pkt.header.dwsize = API_FRAME_SIZE_IN_DWORDS;
e220edf2d6fd6d Jack Xiao 2025-05-14 362
e220edf2d6fd6d Jack Xiao 2025-05-14 363 mes_remove_queue_pkt.doorbell_offset = input->doorbell_offset;
e220edf2d6fd6d Jack Xiao 2025-05-14 364 mes_remove_queue_pkt.gang_context_addr = input->gang_context_addr;
e220edf2d6fd6d Jack Xiao 2025-05-14 365
e220edf2d6fd6d Jack Xiao 2025-05-14 366 return mes_v12_1_submit_pkt_and_poll_completion(mes,
75053887d6d8f5 Jack Xiao 2025-03-10 367 xcc_id, AMDGPU_MES_SCHED_PIPE,
e220edf2d6fd6d Jack Xiao 2025-05-14 368 &mes_remove_queue_pkt, sizeof(mes_remove_queue_pkt),
e220edf2d6fd6d Jack Xiao 2025-05-14 369 offsetof(union MESAPI__REMOVE_QUEUE, api_status));
e220edf2d6fd6d Jack Xiao 2025-05-14 370 }
e220edf2d6fd6d Jack Xiao 2025-05-14 371
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-08-07 9:19 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-07 9:19 kernel test robot [this message]
-- strict thread matches above, loose matches on Subject: below --
2026-08-08 22:19 drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:355 mes_v12_1_remove_hw_queue() error: buffer overflow 'mes->master_xcc_ids' 16 <= s32max kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202608071720.ea61NlTG-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.